Terraform 和 Helm3：错误：Kubernetes 集群无法访问

Question

因此，我尝试将带有 helm3 的图表安装到 kubernetes 集群（EKS）。我有一个地形配置如下。实际集群处于活动状态且可见

variable "aws_access_key" {}
variable "aws_secret_key" {}

locals {
  cluster_name = "some-my-cluster"
}

provider "aws" {
  region = "eu-central-1"
  access_key = var.aws_access_key
  secret_key = var.aws_secret_key
}


data "aws_eks_cluster" "cluster" {
  name = local.cluster_name
}

data "aws_eks_cluster_auth" "cluster" {
  name = data.aws_eks_cluster.cluster.name
}

output "endpoint" {
  value = data.aws_eks_cluster.cluster.endpoint
}

output "kubeconfig-certificate-authority-data" {
  value = data.aws_eks_cluster.cluster.certificate_authority.0.data
}

output "identity-oidc-issuer" {
  value = "${data.aws_eks_cluster.cluster.identity.0.oidc.0.issuer}"
}

provider "kubernetes" {
  version                = "~>1.10.0"
  host                   = data.aws_eks_cluster.cluster.endpoint
  cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
  token                  = data.aws_eks_cluster_auth.cluster.token
  load_config_file       = false
}

provider "helm" {
  version                = "~>1.0.0"
  debug = true
  alias = "my_helm"

  kubernetes {
    host = data.aws_eks_cluster.cluster.endpoint
    token = data.aws_eks_cluster_auth.cluster.token
    cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
    load_config_file = false
  }
}

data "helm_repository" "stable" {
  name = "stable"
  url  = "https://kubernetes-charts.storage.googleapis.com"
}

resource "helm_release" "mydatabase" {
  provider  = helm.my_helm
  name  = "mydatabase"
  chart = "stable/mariadb"
  namespace = "default"

  set {
    name  = "mariadbUser"
    value = "foo"
  }

  set {
    name  = "mariadbPassword"
    value = "qux"
  }
}

当我跑步时terraform apply，我看到一个error: Error: Kubernetes cluster unreachable

有什么想法吗？还将欣赏一些如何调试问题的想法 - 调试选项不起作用。

可以确认它适用于新创建的集群。

Answer 1

这个问题的解决方案与 kubectl 提供者有关。我发现唯一可行的解​​决方法是将令牌请求替换为我在下面放置的请求

provider "kubernetes" {
    version                = "~>1.10.0"
    host                   = data.aws_eks_cluster.cluster.endpoint
    cluster_ca_certificate = base64decode(data.aws_eks_cluster.cluster.certificate_authority.0.data)
    exec {
        api_version = "client.authentication.k8s.io/v1alpha1"
        args        = ["eks", "get-token", "--cluster-name", data.aws_eks_cluster.cluster.name]
        command     = "aws"
     }
     load_config_file       = false
}